The Software Safety Project

Thirty years ago, on November 8, 1996, a hacker called Aleph One published “Smashing the Stack for Fun and Profit,” the recipe for exploiting a bug the US government had warned about in 1972. Host Sarina Gandy had never heard of memory safety before this project. In this episode, she learns what the bug is, how it got loose, and what it has cost us, from hospitals locked out by WannaCry to an activist targeted through his iPhone. Along the way, she finally tracks down Aleph One.

On mic
Rob Joyce, former NSA cybersecurity director
Dave Weston, Corporate Vice President for AI Security, Microsoft
Bob Lord, Chief Strategy Officer, Software Safety Institute
Lauren Zabierek, co-founder and CEO, Software Safety Institute
Tarah Wheeler, security executive and Oxford doctoral candidate
Pavlina Pavlova
Nicole Perlroth, journalist and author of This Is How They Tell Me the World Ends
Yael Grauer, author of Consumer Reports’ report on the future of memory safety
Adam Shostack, threat modeling expert
Elias Levy, a.k.a. Aleph One
Crispin Cowan, creator of StackGuard

Chapters
0:00 Governments switch off their own websites
2:07 Meet Sarina, and why she’d never heard of this bug
4:30 Why it’s your problem
7:42 WannaCry and the NHS
9:24 Audrey’s story
10:40 The invisible ankle bracelet: Ahmed Mansoor
12:20 What can an ordinary person do?
13:23 How the bug works
16:31 A warning from 1972, and decades of secrecy
19:00 Aleph One and Smashing the Stack
23:11 StackGuard and the Spartans
24:18 Thirty years of defenses
29:34 NotPetya
31:36 AI changes the map
33:40 Why the bug survives

Referenced in this episode

James P. Anderson, Computer Security Technology Planning Study, Volume II (October 1972), the volume with the description quoted in the episode
https://seclab.cs.ucdavis.edu/projects/history/papers/ande72.pdf

Aleph One, “Smashing the Stack for Fun and Profit,” Phrack 49 (1996)
https://phrack.org/issues/49/14.html

CISA and partners, The Case for Memory Safe Roadmaps (December 2023)
https://www.cisa.gov/resources-tools/resources/case-memory-safe-roadmaps

Yael Grauer, Future of Memory Safety: Challenges and Recommendations, Consumer Reports (January 2023)
https://innovation.consumerreports.org/Memory-Safety-Convening-Report-.pdf

Nicole Perlroth, This Is How They Tell Me the World Ends (Bloomsbury, 2021)
https://en.wikipedia.org/wiki/This_Is_How_They_Tell_Me_the_World_Ends

Credits
The Bug We Let Live is a production of the Software Safety Institute, with generous support from Cyber Florida. Produced by Sarina Gandy. Co-produced by Rex Wilson. Learn more at softwaresafety.org.